- Add graceful shutdown with SIGTERM/SIGINT handling\n- Make model list configurable via config.yaml\n- Remove sensitive data from debug logs (log sizes instead of full bodies)\n- Handle array format in system messages (both string and []interface{})\n- Update config.yaml with new models structure
- Remove unused buildToolCalls() function (logic is inlined)\n- Simplify randomString() using global rand (Go 1.20+)\n- Use dynamic timestamps instead of hardcoded 1234567890\n- Add time import to converter.go
- Add type assertion check for session ID context value to prevent panic\n- Add 10MB request body size limit to prevent memory exhaustion\n- Return 413 (Request Entity Too Large) for oversized requests\n- Add maxBodySize constant for easy adjustment
- Create package-level httpClient with 300s timeout\n- Reuse client instead of creating new one per request\n- Prevents resource exhaustion under load\n- Reduces connection overhead
- Define blockedHeaders map for headers that should never be forwarded
- Include Referer, Cookie, X-Forwarded-* headers
- Prevents leaking internal URLs, session data, and client IPs to upstream
- Defensive measure even though no headers are currently copied
